BuiltInRules.json

[
  {
    "id": "TA-000001",
    "description": "Diagnostic logs in App Services should be enabled",
    "recommendation": "Enable diagnostic Logs in App Services",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000001-diagnostic-logs-in-app-services-should-be-enabled",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "allOf": [
          {
            "path": "kind",
            "regex": "^((?!functionapp).)*$"
          },
          {
            "path": "kind",
            "regex": "^((?!linux).)*$"
          }
        ]
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "allOf": [
            {
              "path": "properties.detailedErrorLoggingEnabled",
              "equals": true
            },
            {
              "path": "properties.httpLoggingEnabled",
              "equals": true
            },
            {
              "path": "properties.requestTracingEnabled",
              "equals": true
            }
          ]
        },
        {
          "allOf": [
            {
              "path": "properties.siteConfig.detailedErrorLoggingEnabled",
              "equals": true
            },
            {
              "path": "properties.siteConfig.httpLoggingEnabled",
              "equals": true
            },
            {
              "path": "properties.siteConfig.requestTracingEnabled",
              "equals": true
            }
          ]
        }
      ]
    }
  },
  {
    "id": "TA-000002",
    "description": "Remote debugging should be turned off for API Apps",
    "recommendation": "Remote debugging should be turned off",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000002-remote-debugging-should-be-turned-off-for-api-apps",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.remoteDebuggingEnabled",
              "notEquals": true
            }
          ]
        },
        {
          "path": "properties.siteConfig.remoteDebuggingEnabled",
          "notEquals": true
        }
      ]
    }
  },
  {
    "id": "TA-000003",
    "description": "FTPS only should be required in your API App",
    "recommendation": "Enable FTPS enforcement for enhanced security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000003-ftps-only-should-be-required-in-your-api-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        },
        {
          "path": "properties.siteConfig.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        }
      ]
    }
  },
  {
    "id": "TA-000004",
    "description": "API App should only be accessible over HTTPS",
    "recommendation": "Use HTTPS to ensure server/service authentication and protect data in transit from network layer eavesdropping attacks",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md#ta-000004-api-app-should-only-be-accessible-over-https",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "allOf": [
        {
          "path": "properties.httpsOnly",
          "equals": true
        }
      ]
    }
  },
  {
    "id": "TA-000005",
    "description": "Latest TLS version should be used in your API App",
    "recommendation": "Upgrade to the latest TLS version",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000005-latest-tls-version-should-be-used-in-your-api-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.minTlsVersion",
          "equals": "1.2"
        },
        {
          "path": "properties.siteConfig.minTlsVersion",
          "equals": "1.2"
        }
      ]
    }
  },
  {
    "id": "TA-000006",
    "description": "CORS should not allow every resource to access your API App",
    "recommendation": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your API app. Allow only required domains to interact with your API app.",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000006-cors-should-not-allow-every-resource-to-access-your-api-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.cors.allowedOrigins[*]",
              "notEquals": "*"
            }
          ]
        },
        {
          "path": "properties.siteConfig.cors.allowedOrigins[*]",
          "notEquals": "*"
        }
      ]
    }
  },
  {
    "id": "TA-000007",
    "description": "Managed identity should be used in your API App",
    "recommendation": "Use a managed identity for enhanced authentication security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000007-managed-identity-should-be-used-in-your-api-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "api$"
      },
      "allOf": [
        {
          "path": "identity.type",
          "in": [
            "UserAssigned",
            "SystemAssigned"
          ]
        }
      ]
    }
  },
  {
    "id": "TA-000008",
    "description": "Remote debugging should be turned off for Function Apps",
    "recommendation": "Remote debugging should be turned off",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000008-remote-debugging-should-be-turned-off-for-function-apps",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.remoteDebuggingEnabled",
              "notEquals": true
            }
          ]
        },
        {
          "path": "properties.siteConfig.remoteDebuggingEnabled",
          "notEquals": true
        }
      ]
    }
  },
  {
    "id": "TA-000009",
    "description": "FTPS only should be required in your Function App",
    "recommendation": "Enable FTPS enforcement for enhanced security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000009-ftps-only-should-be-required-in-your-function-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        },
        {
          "path": "properties.siteConfig.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        }
      ]
    }
  },
  {
    "id": "TA-000010",
    "description": "Function App should only be accessible over HTTPS",
    "recommendation": "Use HTTPS to ensure server/service authentication and protect data in transit from network layer eavesdropping attacks",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000010-function-app-should-only-be-accessible-over-https",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "allOf": [
        {
          "path": "properties.httpsOnly",
          "equals": true
        }
      ]
    }
  },
  {
    "id": "TA-000011",
    "description": "Latest TLS version should be used in your Function App",
    "recommendation": "Upgrade to the latest TLS version",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000011-latest-tls-version-should-be-used-in-your-function-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.minTlsVersion",
          "equals": "1.2"
        },
        {
          "path": "properties.siteConfig.minTlsVersion",
          "equals": "1.2"
        }
      ]
    }
  },
  {
    "id": "TA-000012",
    "description": "CORS should not allow every resource to access your Function Apps",
    "recommendation": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Function app. Allow only required domains to interact with your Function app.",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000012-cors-should-not-allow-every-resource-to-access-your-function-apps",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.cors.allowedOrigins[*]",
              "notEquals": "*"
            }
          ]
        },
        {
          "path": "properties.siteConfig.cors.allowedOrigins[*]",
          "notEquals": "*"
        }
      ]
    }
  },
  {
    "id": "TA-000013",
    "description": "Managed identity should be used in your Function App",
    "recommendation": "Use a managed identity for enhanced authentication security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000013-managed-identity-should-be-used-in-your-function-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "path": "kind",
        "regex": "^functionapp"
      },
      "allOf": [
        {
          "path": "identity.type",
          "in": [
            "UserAssigned",
            "SystemAssigned"
          ]
        }
      ]
    }
  },
  {
    "id": "TA-000014",
    "description": "Remote debugging should be turned off for Web Applications",
    "recommendation": "Remote debugging should be turned off",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000014-remote-debugging-should-be-turned-off-for-web-applications",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.remoteDebuggingEnabled",
              "notEquals": true
            }
          ]
        },
        {
          "path": "properties.siteConfig.remoteDebuggingEnabled",
          "notEquals": true
        }
      ]
    }
  },
  {
    "id": "TA-000015",
    "description": "FTPS only should be required in your Web App",
    "recommendation": "Enable FTPS enforcement for enhanced security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000015-ftps-only-should-be-required-in-your-web-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        },
        {
          "path": "properties.siteConfig.ftpsState",
          "in": [ "FtpsOnly", "Disabled" ]
        }
      ]
    }
  },
  {
    "id": "TA-000016",
    "description": "Web Application should only be accessible over HTTPS",
    "recommendation": "Use HTTPS to ensure server/service authentication and protect data in transit from network layer eavesdropping attacks",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000016-web-application-should-only-be-accessible-over-https",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "allOf": [
        {
          "path": "properties.httpsOnly",
          "equals": true
        }
      ]
    }
  },
  {
    "id": "TA-000017",
    "description": "Latest TLS version should be used in your Web App",
    "recommendation": "Upgrade to the latest TLS version",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000017-latest-tls-version-should-be-used-in-your-web-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "anyOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "path": "properties.minTlsVersion",
          "equals": "1.2"
        },
        {
          "path": "properties.siteConfig.minTlsVersion",
          "equals": "1.2"
        }
      ]
    }
  },
  {
    "id": "TA-000018",
    "description": "CORS should not allow every resource to access your Web Applications",
    "recommendation": "Cross-Origin Resource Sharing (CORS) should not allow all domains to access your Web application. Allow only required domains to interact with your Web app.",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000018-cors-should-not-allow-every-resource-to-access-your-web-applications",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Web/sites/config",
          "where": {
            "path": "name",
            "regex": "web$"
          },
          "allOf": [
            {
              "path": "properties.cors.allowedOrigins[*]",
              "notEquals": "*"
            }
          ]
        },
        {
          "path": "properties.siteConfig.cors.allowedOrigins[*]",
          "notEquals": "*"
        }
      ]
    }
  },
  {
    "id": "TA-000019",
    "description": "Managed identity should be used in your Web App",
    "recommendation": "Use a managed identity for enhanced authentication security",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000019-managed-identity-should-be-used-in-your-web-app",
    "evaluation": {
      "resourceType": "Microsoft.Web/sites",
      "where": {
        "anyOf": [
          {
            "path": "kind",
            "exists": false
          },
          {
            "path": "kind",
            "regex": "^app"
          }
        ]
      },
      "allOf": [
        {
          "path": "identity.type",
          "in": [
            "UserAssigned",
            "SystemAssigned"
          ]
        }
      ]
    }
  },
  {
    "id": "TA-000020",
    "description": "Use built-in roles instead of custom RBAC roles",
    "recommendation": "Use built-in roles such as 'Owner, Contributer, Reader' instead of custom RBAC roles",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000020-use-built-in-roles-instead-of-custom-rbac-roles",
    "evaluation": {
      "resourceType": "Microsoft.Authorization/roleDefinitions",
      "path": "properties.type",
      "notEquals": "CustomRole"
    }
  },
  {
    "id": "TA-000021",
    "description": "Automation account variables should be encrypted",
    "recommendation": "Enable encryption of Automation account variable assets when storing sensitive data",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000021-automation-account-variables-should-be-encrypted",
    "evaluation": {
      "resourceType": "Microsoft.Automation/automationAccounts/variables",
      "path": "properties.isEncrypted",
      "equals": true
    }
  },
  {
    "id": "TA-000022",
    "description": "Only secure connections to your Azure Cache for Redis should be enabled",
    "recommendation": "Enable connections via SSL only to Redis Cache",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000022-onlysecureconnectionstoyourazurecacheforredisshouldbeenabled",
    "evaluation": {
      "resourceType": "Microsoft.Cache/redis",
      "path": "properties.enableNonSslPort",
      "notEquals": true
    }
  },
  {
    "id": "TA-000023",
    "description": "Authorized IP ranges should be defined on Kubernetes Services",
    "recommendation": "Restrict access to the Kubernetes Service Management API by granting API access only to IP addresses in specific ranges",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000023-authorized-ip-ranges-should-be-defined-on-kubernetes-services",
    "evaluation": {
      "resourceType": "Microsoft.ContainerService/managedClusters",
      "anyOf": [
        {
          "path": "properties.apiServerAccessProfile.authorizedIPRanges",
          "exists": true
        },
        {
          "path": "properties.apiServerAccessProfile.enablePrivateCluster",
          "equals": true
        }
      ]
    }
  },
  {
    "id": "TA-000024",
    "description": "Role-Based Access Control (RBAC) should be used on Kubernetes Services",
    "recommendation": "Enable RBAC in Kubernetes clusters",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000024-role-basedaccesscontrolrbacshouldbeusedonkubernetesservices",
    "evaluation": {
      "resourceType": "Microsoft.ContainerService/managedClusters",
      "allOf": [
        {
          "path": "properties.enableRBAC",
          "hasValue": true
        },
        {
          "path": "properties.enableRBAC",
          "equals": true
        }
      ]
    }
  },
  {
    "id": "TA-000025",
    "description": "Kubernetes Services should be upgraded to a non-vulnerable Kubernetes version",
    "recommendation": "Upgrade to a non-vulnerable Kubernetes version (1.11.9+, 1.12.7+, 1.13.5+, and 1.14.0+)",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000025-kubernetes-services-should-be-upgraded-to-a-non-vulnerable-kubernetes-version",
    "evaluation": {
      "resourceType": "Microsoft.ContainerService/managedClusters",
      "allOf": [
        {
          "not": {
            "path": "properties.kubernetesVersion",
            "regex": "^1\\.((11\\.[0-8])|(12\\.[0-6])|(13\\.[0-4]))"
          }
        },
        {
          "not": {
            "path": "properties.kubernetesVersion",
            "regex": "^1\\.(([0-9]|10)\\.\\d+)"
          }
        }
      ]
    }
  },
  {
    "id": "TA-000026",
    "description": "Service Fabric clusters should only use Azure Active Directory for client authentication",
    "recommendation": "Enable AAD client authentication on your Service Fabric clusters",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000026-service-fabric-clusters-should-only-use-azure-active-directory-for-client-authentication",
    "evaluation": {
      "resourceType": "Microsoft.ServiceFabric/clusters",
      "path": "properties.azureActiveDirectory.tenantId",
      "hasValue": true
    }
  },
  {
    "id": "TA-000027",
    "description": "Transparent Data Encryption on SQL databases should be enabled",
    "recommendation": "Transparent data encryption should be enabled to protect data-at-rest and meet compliance requirements",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000027-transparent-data-encryption-on-sql-databases-should-be-enabled",
    "evaluation": {
      "resourceType": "Microsoft.Sql/servers/databases",
      "where": {
        "path": "name",
        "regex": ".+(?<!master)$"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Sql/servers/databases/transparentDataEncryption",
          "path": "properties.state",
          "equals": "enabled"
        }
      ]
    }
  },
  {
    "id": "TA-000028",
    "description": "SQL servers with auditing to storage account destination should be configured with 90 days retention or higher",
    "recommendation": "Set the data retention for your SQL Server's auditing to storage account destination to at least 90 days",
    "helpUri": "https://github.com/Azure/template-analyzer/blob/main/docs/built-in-bpa-rules.md/#ta-000028-sql-servers-with-auditing-to-storage-account-destination-should-be-configured-with-90-days-retention-or-higher",
    "evaluation": {
      "resourceType": "Microsoft.Sql/servers",
      "where": {
        "path": "properties.kind",
        "regex": "^((?!analytics).)*$"
      },
      "allOf": [
        {
          "resourceType": "Microsoft.Sql/servers/auditingSettings",
          "where": {
            "path": "name",
            "equals": "default"
          },
          "anyOf": [
            {
              "allOf": [
                {
                  "path": "properties.isAzureMonitorTargetEnabled",
                  "equals": true
                },
                {
                  "path": "properties.storageEndpoint",
                  "hasValue": false
                }
              ]
            },
            {
              "path": "properties.retentionDays",
              "equals": 0 // 0 == unlimited retention
            },
            {
              "path": "properties.retentionDays",
              "greaterOrEquals": 90
            }
          ]
        }
      ]
    }
  }
]